A stored cross‑site scripting vulnerability exists in the content creation endpoint of HTMLy version 3.1.1. The application fails to sanitize user input, allowing attackers to inject arbitrary HTML or JavaScript. If exploited, malicious code will run in the browsers of users who view the affected content, potentially leading to session hijacking, defacement, or other malicious actions. This flaw represents a classic cross‑site scripting weakness.

The affected product is HTMLy, version 3.1.1. No other vendors or products were identified. Users of this specific version are directly impacted.

The CVSS score is not disclosed, and the EPSS score is unavailable, so the formal severity cannot be computed. However, the flaw is exploitable by any user with access to the image content creation endpoint. Because injected code executes in the victim's browser, the impact is high if the content is publicly viewable. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploits as of the last update. Nonetheless, the lack of proper input validation presents a significant risk that should be mitigated.